Slashdot Mirror

← Back to Stories (view on slashdot.org)

Onion Pi — Make a Raspberry Pi Into a Anonymizing Tor Proxy

Posted by Soulskill on from the tasty-and-private dept.

coop0030 writes "Feel like someone is snooping on you? Browse anonymously anywhere you go with the Onion Pi Tor proxy. This is fun weekend project from Adafruit that uses a Raspberry Pi, a USB WiFi adapter and Ethernet cable to create a small, low-power and portable privacy Pi."

50 of 76 comments (clear)

  1. Neat idea. by BitterOak · · Score: 4, Interesting

    I've always thought the Raspberry Pi would be a pontentially much more useful device if it had two Ethernet ports instead of one. It could be a NAT box, Firewall, TOR proxy, or any number of other things. By separating these functions form the computers you're trying to protect, you potentially have a lot more security. Dare I dream there will be a model with two Ethernet ports sometime in the future?

    --
    If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
    1. Re:Neat idea. by ZerXes · · Score: 1

      I don't really see the need, any switch capable of Dot1q will solve the problem for you anyhow...

    2. Re:Neat idea. by BitterOak · · Score: 1

      Um... $50 dollar routers have been done, for a few years now.

      I know. I have one myself. But the cool thing about the Pi is you could run whatever software you like, or even write it yourself, and it would be open source. I'm frequently reading about vulnerabilities showing up in off the shelf routers. With a software solution on a Pi, you could patch and upgrade it yourself. And if it didn't offer the features you wanted, you could add them.

      --
      If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
    3. Re:Neat idea. by ColaMan · · Score: 3, Funny

      Yes, that's right, don't bother about adding a single ethernet port, merely invest in a VLAN-capable switch! You always need another piece of power-hungry overkill hardware when you're using your Pi in a remote location somewhere (or even behind your TV), and you've got money to burn now that you've saved so much money buying a Pi!

      Brilliant! /s

      --

      You are in a twisty maze of processor lines, all alike.
      There is a lot of hype here.
    4. Re:Neat idea. by Anonymous Coward · · Score: 2, Informative

      Um... $50 dollar routers have been done, for a few years now.

      I know. I have one myself. But the cool thing about the Pi is you could run whatever software you like, or even write it yourself, and it would be open source. I'm frequently reading about vulnerabilities showing up in off the shelf routers. With a software solution on a Pi, you could patch and upgrade it yourself. And if it didn't offer the features you wanted, you could add them.

      The cited router, runs Linux, with several distros with prepackaged TOR modules available. See openWrt, DDWrt, Tomato and more. Everything you suggest was done on the WRT54G 5 or more years ago. Raspberry Pi offers nothing new. It is under powered, lacks ports or WiFi, doesn't have established router software support... There is no advantage to using a Pi for a router over the linked router. None.

    5. Re:Neat idea. by gl4ss · · Score: 1

      i highly doubt it doing tor off the shelf.

      but fun fact, cheapo home routers were used for some of the stuff raspberry is now used for.. for years. some had gpio hacks too.

      --
      world was created 5 seconds before this post as it is.
    6. Re:Neat idea. by Deliveranc3 · · Score: 1

      2 Watts? For the Pi, power hungry? Also, why does it need 2 net connections to perform as your and others' Tor node?

    7. Re:Neat idea. by gweihir · · Score: 4, Interesting

      The Pi does not have native Ethernet anyways. You can add a second one with an 100Mbps USB2-to-Ethernet adapter without losing much. For native interfaces, an Alix board may be a better choice.

      What irks me more is that the Pi has issues with quite a few USB hubs. In fact I found none that worked well in a stress-test (two memory sticks connected as RAID1, always lost one during re-sync, no matter what sticks I used), and I tried several.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    8. Re:Neat idea. by larry+bagina · · Score: 1

      They'd probably sell a lot better if the rearranged the letters a bit... eShavePlug

      --
      Do you even lift?

      These aren't the 'roids you're looking for.

    9. Re:Neat idea. by BitZtream · · Score: 2

      So plug in a USB ethernet adapter and stop your bitching, thats all the onboard on is anyway. Its just connected directly to the onboard hub, the other two ports are exposed.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
    10. Re:Neat idea. by Deliveranc3 · · Score: 1

      No reason they can't make a revision C, unless competition from BeagleBox cripples them?
      br Can we keep the Brit's in charge and userfriendly culture, and get some teamwork you two?

    11. Re:Neat idea. by Deliveranc3 · · Score: 1

      It's a bit sad that the Pi won't run off a standard powered usb hub (for the micro-usb power), while, running devices off that hub... Only complaint.

    12. Re: Neat idea. by swsuehr · · Score: 3, Interesting

      I'm doing exactly this. I have a Pi firewall running with three total ethernet ports (the third is a wifi DMZ). I got another Pi and it's running asterisk for the house with a POTS connection via an Obi110. However, based on the load and RAM usage I could be using a single Pi for both. Speed tests show that the Pi performs the same as the full scale computer that it replaced. Check my blog for more details on the firewall rig. I haven't blogged about the asterisk setup yet. Steve

    13. Re:Neat idea. by drinkypoo · · Score: 1

      If you're trying to say that you can't power a hub from a wall-wart, plug the hub into the Pi as a hub, and then also run a power cable from the hub to the Pi, then you're wrong. I've done it with one of those world's-cheapest four-port USB2 hubs that has the molded foot-long pigtail and the really square transparent case. I'm not doing it now — a $5-6 boost-buck DC-DC converter found on eBay will let you run your Pi on practically anything that will deliver enough current.

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    14. Re:Neat idea. by drinkypoo · · Score: 1

      What irks me more is that the Pi has issues with quite a few USB hubs.

      Have you performed any of the modifications intended to address the issues with USB power delivery? Sure, it shouldn't matter if you're using a powered hub, but have you tried?

      The big problem with the Pi is that its USB is defective, and everything hangs off the USB. Great plan. Better buy a Cubieboard or the new Beaglebone. Hopefully Canonical will fulfill their promise of Mir supporting arbitrary Android video drivers, and then those who don't need GPIO (perhaps choosing to hang an Arduino or similar off of USB to handle realtime tasks) will be able to use Ouya or another similarly high-powered STB to run Linux. (Anyone had an ODROID-U2 for long enough to tell us if they really meant it when they gave it a four week warranty?)

      --
      "You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
    15. Re:Neat idea. by BitZtream · · Score: 2

      My ASUS N-66R runs Linux, and the source is available, I do run 'whatever software I like on it' already.

      Its like a Rasp PI except instead of having VideoCore4 it has BadAssSwitchingAsicsNotOnAUSBHub. I'll take 6 usable gigabit ports on asics over 3 crappy nics on USB from a device that requires a perfect power supply or the USB craps out, and takes the networking with it.

      The RaspPi offers absolutely nothing from a router perspective that isn't already available in routers that do all of it better.

      Oh, and adding Tor to my router is probably as simple as using the factory installed web interface to a package manager. I haven't bothered to look for Tor, but seems as likely as all the other stuff they have in there.

      --
      Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
    16. Re:Neat idea. by gweihir · · Score: 1

      It is not a power-issue I have. It is a hub-driver issue where devices vanish. It looked like power problems or a while, but then I tried to nail them down with a digital oscilloscope, and it is definitely _not_ a power issue. To be sure, I added additional buffer caps in the overkill range, no effect at all. The USB hub drivers just suck. Incidentally, without the hub in between, the USB sticks just work.

      I expect this will get fixed eventually, bit at this time it has not been. One problem is that many USB hubs have their quirks and while the mainline PC drivers have them figured out, the ones on the pi have not yet.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    17. Re:Neat idea. by Anonymous Coward · · Score: 1

      The whole point of the Raspberry Pi is to be a power-hungry hardware overkill solution to trivial problems. Since when do people care about hardware overkill when it takes 8GB and a 4GHz CPU to run a spreadsheet?

    18. Re:Neat idea. by bill_mcgonigle · · Score: 1

      I expect this will get fixed eventually

      Like the GP said, USB on the RPi is defective. There's an infamous lkml post outlining the problems.

      The SD slot is defective too - a tremendous number of stories are out there about SD corruption. Too bad it's the only possible boot device.

      oh, and the h.264 decoder is defective too. Blocking artifacts, GPU lockups.

      People tell me the Beaglebone Black is what the RPi was supposed to be.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    19. Re:Neat idea. by bill_mcgonigle · · Score: 1

      I've done it with one of those world's-cheapest four-port USB2 hubs that has the molded foot-long pigtail and the really square transparent case.

      And I'm doing it now with this hub which was recommended for RPi noobs when I bought mine.

      It does pain me to run a hub that's nearly as expensive as the computer, but I was going for the zero-frustration approach. "World's cheapest" does appeal to the low-cost solutions driver in me, though - got a link?

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    20. Re:Neat idea. by Ginger+Unicorn · · Score: 1

      I have two Pi's and they are flaky as hell, in all the arenas you mention. It's such a shame. Is there any indication that they're going to revise future models to fix any of these problems?

      --
      (1.21 gigawatts) / (88 miles per hour) = 30 757 874 newtons
    21. Re:Neat idea. by gweihir · · Score: 1

      Well, when I dug into the I/O lines, I already had the impression that the people designing the Pi are not really good as hardware designers. For example, I am pretty sure now the I/O lines are 5V tolerant when used as inputs. And while the information is easily available in the confidential datasheet, nothing has been published by the Pi team. This indicates a fundamental non-understanding of what is important and what is not.

      So far I have not had issues with the SD slot, fortunately. Maybe people are using it wrong? Maybe people are short-circuiting power, thereby making it impossible for the SD card itself to get to a consistent state? Incidentally, that is true for ordinary HDDs as well. If you short-circuit the power, they lose data. It is just better on HDD, because they have smaller sectors that also align to FS units, so journaling can (usually) compensate for it. But this is how some kernel developers found out that some HDDs lie about having flushed data to disk surface (and breaking the benefits of journaling that way).

      As to USB, I still hope that very conservative driver settings and fault-tolerance will be able to fix the problem eventually. Would not be the first defective hardware fixed in software. Without hub, it has been working reasonably reliable so far.

      Fortunately, I do not care about video at all.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    22. Re: Neat idea. by SlipperySausage · · Score: 1

      Have you even tested it? We have been running the Sphirewall open source firewall router including layer7 packet filtering on the pi and we are seeing up to 70mbps. That is NAT through a usb ethernet adapter and the on board (Its all on the usb bus anyway). Sphirewall replaces netfilter in the linux kernel with an optimized filter / kernel module. So running this thing as a firewall / router isn't such a big issue. The latest source from svn for sphirewall has no trouble with the Pi.

    23. Re:Neat idea. by bill_mcgonigle · · Score: 1

      So far I have not had issues with the SD slot, fortunately. Maybe people are using it wrong?

      nor have I, but from what I read, some really competent people do, so I'm figuring it's a matter of time. I saw reports of "fine for two months and then corruption". I'm looking to try PXE booting them next, to minimize writes.

      Apparently the SD card write timings are out of spec, and some SD cards are tolerant of this and some aren't. I suppose with a tolerant enough card one might never encounter a problem.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    24. Re:Neat idea. by bill_mcgonigle · · Score: 1

      thanks, I'll check my preferred provider of cheap Chinese electronics.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    25. Re:Neat idea. by gweihir · · Score: 1

      If the timings are out of spec, that means transmission problems. The cards have controllers, but AFAIK no CRC on commands and data transmitted. That may cause corruption when temperature is shifting timing parameters, either on the card or on the Pi. OTOH, this is an SPI bus with 4 instead of one data lines. It is really hard to get the timing wrong. Basically, you can only transmit data on the wrong flank, which could result in a flaky interface, but doing so is really, really stupid. The other thing you can to is set the clock too high. AFAIK, the SD card has metadata that tells the host how far it can go. Again, getting this wrong is really, really stupid. To get this right, you calculate it exactly, verify with a digital oscilloscope or logic analyzer (will also tell you whether you transfer data on the right flank), and then run it 20% or so slower to get a safety margin.

      Come to think of it, this type of problem would explain why so many SD cards have problems with the Pi. Seems to me that this is something that could be fixed in the firmware. After all, digital cameras, smartphones, MP3 players, etc. all get it right. Maybe the Pi designers really have trouble with reading and understanding data sheets and were using an experimental approach. If you do that, you can end up with things that are sensitive to shifting conditions, primary temperature changes. These can show up with long delays. For example, in winter, everything may be fine, but in summer it breaks because of 15C more. Can also happen the other way round.

      Now, what definitely helps in both cases is to have a card that is faster than the bus. If the clock is too high, it solves the issue completely. If the flank is wrong, it increases the margin, possibly enough for it to work reliably. I am using some 30MB/s cards, which should give plenty of safety margin as the Pi seems to level out at about 12MB/s.

      Do you have a link to the reference that says it is a timing issue?

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    26. Re:Neat idea. by bill_mcgonigle · · Score: 1

      The other thing you can to is set the clock too high

      From what I've read, overclocking is a sure way to find a corrupt SD, so you might be onto something there. Some have said that the UK units are more reliable when they have both UK and Chinese units side-by-side. I don't know if that's true.

      and then run it 20% or so slower to get a safety margin

      and if you forgot to factor in the 20%? Just a hunch.

      After all, digital cameras, smartphones, MP3 players, etc. all get it right.

      Exactly, which makes this so frustrating. Call me naive, but this seems like a solved problem.

      Now, what definitely helps in both cases is to have a card that is faster than the bus. ... I am using some 30MB/s cards, which should give plenty of safety margin as the Pi seems to level out at about 12MB/s.

      Hrm, now from what I've seen it's people using the Class 4 cards who are having better luck than those on Class 6 or 10 cards. But, and my memory from a few years ago is rusty, but at the time I was doing some embedded linux development (just COTS parts) and I wound up going with Class 4 cards instead of 6 or 10 at the time because their actual transfer capability was often higher, at least among certain manufacturers. I forget why, but Class 10 was a "burst out the gates" kind of fast, that faltered shortly. Again, this is years-old r&d, it might have changed by now. I'm running some of those old cards in my Pis and so far so good, though.

      Do you have a link to the reference that says it is a timing issue?

      I tried looking just now with 'raspberry pi sd card "timing"' and found a bunch of references to it, but, sorry, not the analysis I was thinking of. Just for thread completeness, here's the lkml post talking about the USB problems.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    27. Re:Neat idea. by gweihir · · Score: 1

      You are perfectly right, this _is_ a solved problem, apparently just not to the Pi team. Lets hope somebody that knows how to do this right will solve it for them in the near future.

      --
      Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
  2. Funny by vikingpower · · Score: 1

    It seems to me that on this kind of topic, since the NSA scandal, the percentage of anonymous posters has seen a sudden and major increase.

    --
    Religous speak to God. Insane are spoken to by God. When all shut up, one can finally hear Shostakovich in peace
    1. Re:Funny by SteveFoerster · · Score: 2

      Good luck to them if they think that helps. Me, I'm pretty sure I've been on their enemies list for years.

      --
      Space game using normal deck of cards: http://BattleCards.org
    2. Re:Funny by vilanye · · Score: 1

      Paranoia and delusions of grandeur is a scary combination.

      Seek help.

    3. Re:Funny by SteveFoerster · · Score: 1

      Well, you get points for snarkiness, but you should have a few beers with me before you decide it's either paranoia or a delusion of grandeur. I don't think I'm important, if that's what you mean, but I used to do moneypunk stuff (like Bitcoin, except with gold and it was twelve years ago) and a number of people I worked with in that time have been imprisoned. Besides, I expect their watchlist is long, that the threshold for being on it is low, and that being on it doesn't lead to immediate obvious consequences.

      --
      Space game using normal deck of cards: http://BattleCards.org
  3. A Anonymizing by mooingyak · · Score: 3, Funny

    Should be "an anonymizing". Not because it's grammatically correct (though it is), but because it's more fun to say.

    --
    William of Ockham had no beard. The most likely explanation is that it was chewed off by squirrels every morning.
    1. Re:A Anonymizing by Impy+the+Impiuos+Imp · · Score: 1

      Hey, you're right. It was fun to say an "an anonymizing".

      Wait. WHOAAAAAAA!

      --
      (-1: Post disagrees with my already-settled worldview) is not a valid mod option.
  4. Re:You must be by K.+S.+Kyosuke · · Score: 4, Funny

    More like a torrorist, don't you think? And I'm sure The Onion would jump on it.

    --
    Ezekiel 23:20
  5. Danger by Anonymous Coward · · Score: 5, Informative

    Note that routing through Tor can hide your location, but it will not protect unencrypted traffic from eavesdropping and MITM attacks.

    I would caution strongly against indiscriminately running all your traffic trough Tor. In many cases this will increase your chance of being subject to an active or passive attack, as one of the reasons people operate Tor exit nodes is to observe the outgoing traffic, either for research or for more clandestine purposes.

    Preferably only use it for encrypted traffic where you have a way to authenticate the other side. Routing TLS traffic through Tor should be fine for personal use, as long as you take care to never accept self-signed certificates.

    1. Re:Danger by aaarrrgggh · · Score: 1

      Oh, your browser has the .mil CAs removed?

  6. Take the warnings seriously! by gweihir · · Score: 4, Informative

    It is really no good using Tor when your application screams to the world who you are. Applications need to be carefully vetted in order to be sure they do not. Better use the Tor browser bundle from a clean system, than this "solution", unless you are really sure you know what you are doing.

    --
    Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
    1. Re:Take the warnings seriously! by bill_mcgonigle · · Score: 2

      Don't plug up tor with streaming video - use a VPN provider for that. You need an endpoint IP, not anonymity.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    2. Re:Take the warnings seriously! by jones_supa · · Score: 2

      For improved anonymity:

      - Adjust your web browser to not send the user agent (browser name and version), to not send referrer information (from which page you came to the current one) and disable cookies by default
      - Do not use any Google products
      - Opt out from any "customer experience improvement programs" in applications' settings

      Feel free to expand the list...

    3. Re:Take the warnings seriously! by BenEnglishAtHome · · Score: 1

      Better use the Tor browser bundle from a clean system, ...unless you are really sure you know what you are doing.

      A clean system on your own system is available for free by dropping in this and re-booting. It's what I use to introduce people to TOR.

  7. Why? by Score+Whore · · Score: 2

    Or you could just install tor on your laptop? What does the added complexity of using a weak arm based linux box to proxy for you bring?

    Additionally what's the use case for this? Where are you plugging in ethernet so your rapi can be your access point?

    1. Re:Why? by jones_supa · · Score: 1

      Or you could just install tor on your laptop?

      You could. But this wraps the Tor functionality nicely inside your networking equipment. It's a matter of taste really.

  8. So, you discovered apt-get? by BitZtream · · Score: 2

    You've been able to do this since Raspian was released ... probably before then and in other releases for the pi as well.

    https://www.torproject.org/docs/debian

    Why exactly does anyone care that adafruit posted something about using pre-packaged software from probably close to 2 years ago?

    --
    Persistent Volume manager for Kubernetes - https://github.com/dwimsey/openshift-pvmanager
  9. Re:Cause... by fuzzyfuzzyfungus · · Score: 2

    Cause using TOR wasn't slow enough already, we'll put it on under-performing hardware.

    Unless you have an atypically-nice-by-American-standards connection to play with, an rPI is luxury. Doesn't mean that onion routed connections aren't always going to be much higher latency(and, in practice, slowed by their dependence on donor bandwidth); but Tor at low speeds(especially one that is basically just serving you, not terminating a whole lot of TLS connections) isn't very demanding.

  10. Re:Onion Pi ... should've called it... by c0lo · · Score: 2

    Pitor and the snow dog :D

    Nah... doesn't strike any chord. With an Onion Pi, I could cry a river.

    --
    Questions raise, answers kill. Raise questions to stay alive.
  11. FreedomBox by rea1l1 · · Score: 2, Interesting

    Check this out

    http://freedomboxfoundation.org/

    p2p mesh based on %100 open source software and hardware

  12. Re:It's "AN anonymizing"... by SteveFoerster · · Score: 1

    No problem, I just asked my Jewish friends to knock it off and they said they were sorry and would stop enslaving us all.

    --
    Space game using normal deck of cards: http://BattleCards.org
  13. Re:It's "AN anonymizing"... by jones_supa · · Score: 1

    Why do Americans keep writing 'an' instead of 'a', and 'a' instead of 'an'? It isn't rocket science.

    As you brought the issue up, I actually have an additional grammar question that's been bugging me for a while. If I use some abbreviation in my sentence, such as "ADSL" or "GPU", does this change rules whether I should use "a" or "an" before it? Because I think I have seen "an" being used often despite the following abbreviation beginning with a consonant.

  14. Who's fucking by ThurstonMoore · · Score: 1

    "LadyAda" over at Slashdot, her company has been getting a lot of free advertisement lately.